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A METHOD OF USING TRANSIENT FAULTS 
TO VERIFY THE SECURITY OF A CRYPTOSYSTEM 

5 

BACKGROUND OF THE INVENTION 
Field of the Invention 

The present invention relates to cryptanalysis and, more particularly, 
relates to methods for "cracking", or deciphering, cryptosystems, by analyzing 

10 one or more erroneous outputs to infer information ordinarily difficult or 
impossible for a party not privy to secret information. Knowing how a 
cryptosystem may be cracked suggests methods for avoiding attacks on the 
cryptosystem, thus further improving the integrity of the cryptosystem. A 
security expert or cryptosystem designer may use the inventive methods in the 

15 design of cryptography devices to verify that an existing or proposed device is 
impervious to such attacks. 

Discussion of Related Art 

Cryptography has become essential to the acceptance of electronic 
20 commerce and sensitive electronic communications. For example, secure digital 
signatures and verification methods provide high assurance that a party is who 
it represents itself to be. This assurance is vital to the general acceptance of, 
for example, commerce over the Internet, the use of electronic money, cellular 
communications, and remote computer login procedures. Typically, certain 
25 well-known cryptographic methods are used to encrypt information in a manner 
that is very difficult to decrypt without certain secret information, thus making 



these signatures and verifications secure. One type of cryptographic method 
which is commonly used is public key cryptography. 
1. Public Key Cryptography 
In a typical public key cryptographic system, each party / has a public key 
5 (or exponent) P, and a secret key (or exponent) S ; . The public key P, is known 
to everyone, but the secret key S, is known only to party /. A plain text 
message m to user / is encrypted to form the cipher text message x using a 
public operation P which makes use of the public key P,- known to everyone, 
i.e., x = P{m,P,). The cipher text message x is decrypted using a secret 
10 operation 5 which makes use of the secret key S /7 i.e., m = S{x,S l ). Only party 
/ who has the secret key Sj can perform the secret operation to decrypt the 
encrypted message x to obtain clear text message m. 

Public key cryptographic techniques may be used for authentication. 
Authentication is a (theoretically) fool-proof technique for a party to verify that 
15 a party contacting it is the party is asserts to be. For example, a confidential 
network may require that a party authenticate itself before gaining access to 
the network. 

If it is true that / > (S(x,S / ),P / ) = x (recall the S(x,S,)=m, resulting in 
P{m,P f ) =x), then the owner of the corresponding keys P,-, S, could sign message 
20 m by producing E = S(m,S i ) l where £ indicates the signature. The verifier, given 
x and E, will verify x = P{E,P t ). One type of a cryptography system could be 
used for verification as follows: challenge the party claiming to be / with 
message x and ask the party to sign the message x using his secret key S„ then 
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verify the signature using P,. More efficient and secure authentication protocols 
may be used, such as the Fiat-Shamir and Schnorr protocols discussed below. 

Fig. 1A is a block diagram of a typical cryptography device 100. The 
device 100 has a processor 102 including one or more CPUs 102, a main 
5 memory 104, a disk memory 106, an input/output device 108, and a network 
interface 110. The devices 102-110 are connected to a bus 120 which 
transfers data, i.e., instructions and information between each of these devices 
102-110. 

Fig. 1B illustrates a network 150 over which cryptography devices 100 
10 may communicate. Two or more cryptography devices 100, 100' may be 
connected to a communications network 1 52, such as a wide area network; 
which may be the Internet, a telephone network, or leased lines; or a local area 
network. Each device 100 may include a modem 154 or other network 
communication device to send encrypted messages over the communications 
15 network 1 52. A cryptography device 1 00 may be a gateway to a sub-network 
1 56. That is, the device 1 00 may be an interface between a wide area network 
1 52 and a local area (sub) network 1 56. 

An example of a public key cryptographic technique which may be 
performed by the device 100 is the well known RSA technique. In accordance 
20 with this technique, a party / has stored in memory 1 04 or 1 06 its own public 
key (or exponent) e, and modulus N (where N is a product of two large prime 
numbers p,q) and a secret key in the form of an exponent s,. It has stored or 
otherwise obtained the public key e, of a party to which it wishes to send a 
message. The party may have a plain text message m which it wishes to send 



to party / without others knowing the content of m. The device 1 00 encrypts 
the message m to form x^rrf' mod N using processor 102 and perhaps 
software stored in main memory 1 04. Party /s device can then decrypt x to 
obtain m by performing the operation m=X s * mod N. 
5 Another public key cryptographic technique is the Rabin modular square 

root. In this technique, the secret operation involves obtaining a modular 
square root and the public operation involves a modular squaring operation. 

Rabin's Signature Scheme is similar to the RSA signature system and 
relies on the difficulty of factoring for its security. As above, assume N=pq is 
10 a product of two large prime numbers p,q. To sign a document D, party i's 
device 100 first hashes D to a number D' between 1 and N. The signer's 
device 1 00, which knows the secret factorization of the modulo N, computes 
the square root of D' (mod N) using the processor 102. Thus, the signature E 
is: 

E = N /lT / (mod N) 

15 (1) 
Without knowing the factorization of N, computing the modular square root of 
a number is difficult. 

The Fiat-Shamir authentication scheme is a cryptosystem for a first party 
to authenticate its identity to another party. This is done as follows: party i's 

20 cryptography device 1 00 and party J's cryptography device 1 00' (as seen in Fig. 
1 B) agree on an /7-bit modulus N = pq, where p and q are each a large prime 
number. Party i's secret keys are a set of invertible elements (i.e., bits) s u ...,s t 
(mod N) stored in the memory 104 or 106 of its cryptography device 100. 



Party i's public key is the square of these invertible elements (bits) 
v, = s 1 2 ,...,v f = s t 2 (mod A/). Party / authenticates itself to party / using the 
following protocol: 

1 . Party i's cryptography device selects a random r, generates r 2 mod 
5 N, and transmits this value to party y's cryptography device. 

2. Party y's cryptography device selects a random subset S£ (i,...,f), 
and transmits the subset to party / via an I/O. 

3. Party i's cryptography device computes y = Afl /G9s Sj mod N and 
transmits y to party /. 

10 4. Party y's device verifies party i's identity by checking that y 2 = 

r^HizsV; (mod N). 

The Schnorr authentication scheme is another cryptosystem for a first 
party to authentic its identity to a second party. The security of the Schnorr 
authentication scheme is based on the difficulty of computing discrete log 
15 modulo a prime. In Schnorr's authentication scheme, party / and party y agree 
on a prime number p and a generator g of Z/, where Z* is group of integers 
modulo p and relatively prime to p. Party / chooses a secret integer s, and 
publishes y, = g* mod p as party i's public key. Party / authenticates itself to 
party / by engaging in the following protocol: 
20 1 . Party i's cryptography device selects a random integer r e [O r p) 

and sends z = mod p to party y's cryptography device via an I/O 
210. 



5 



2. Party /"s cryptography device selects a random integer te [O, 7] 
and sends t to party /' via an I/O. Here, T<p is an upper bound 
chosen beforehand. 

3. Party i's device sends u= r+ts mod p-1 to party y's device. 
5 4. Party y's device verifies that g" = z/ mod p. 

Cryptography schemes such as Schnorr have the property that if two 
distinct messages are signed using the same random element (e.g., r), then the 
secret key of the signer can be computed by anyone having the messages, the 
signatures, and public information such as the public key of the signer. 

10 2. Prior Art Difficulties Cracking Crvptosvstems 

Cracking the RSA public key cryptosystem, and several other 
cryptosystems, is difficult because it typically requires that the modulus be 
factored (or other operation of comparable complexity). This is particularly 
difficult. It takes thousands of hours of computing time to factor a 512 bit 

15 modulus. RSA currently uses a 512 bit modulus, but it is expected that this 
may be upgraded in the future to a 1 024 bit modulus. However, if the modulus 
may be determined without significant factoring, the computing time may be 
greatly reduced and the security of the cryptosystem compromised. 

In an article "Timing Attacks on Implementations of Diffie-Hellman, RSA, 

20 DSS, and Other Systems," Proc. of Crypto '96, P. Kocher proposes that a few 
bits of a modulus may be obtained by the amount of time certain operations 
took to be performed. This allowed the cryptosystem to be cracked without 
factoring. The drawbacks of this method are (1 ) it requires very precise timing 
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of the length of time taken to perform certain calculations; and (2) it requires 
a large number of samples. 

3. Reasons For Cracking A Cryptosvstem 
The availability of electronic commerce and certain electronic 

5 communications depend on difficult-to-crack cryptosystems to prevent 
unauthorized access to the secured information. If, for example, an adversary 
obtains a party's secret key, the adversary could electronically forge the party's 
signature without the party's knowledge. As another example, the adversary 
could present itself to third parties as the party whose secret key was obtained. 

10 Moreover, once obtained, the secret key may be duplicated and shared with 
others. Thus, it is vitally important that the cryptosystem used to protect 
important information be difficult to crack. 

A threat model for cracking a cryptosystem is useful because it verifies 
whether a cryptosystem or cryptography device is vulnerable to that attack. 

15 If so, the system or device is no longer considered to be secure. This is true 
because in the cryptography community, the mere possibility of an attack on 
a cryptosystem is universally accepted as very serious. Security experts must 
assume that the cryptosystem is no longer safe from adversaries. Thus, a 
method for cracking cryptosystems is an exceptionally useful tool for security 

20 experts and cryptosystem designers testing existing cryptosystems and 
developing new cryptosystems. The cracking method may be applied to an 
existing or a proposed system to verify that the system is impervious to the 
attack. Thus, the cracking method may also be used to design cryptosystems 
impervious to the attack. 



7 



Therefore, it is an object of the present invention to provide a method for 
cracking the public key signature cryptosystems without factoring the modulus. 

It is another object of the present invention to provide a method for 
cracking cryptosystems using the Chinese Remainder Theorem. 
5 It is yet a further object of the present invention to provide a method for 

cracking authentication cryptosystems. 

It is yet another object of the present invention to use transient errors in 
encrypted data to determine secret information. 

It is yet a further object of the present invention to provide methods for 
10 testing the security of a cryptosystem. 

It is a further object of the present invention to provide a method for 
providing a cryptosystem and/or cryptography device impervious to cracking 
due to transient hardware faults. 

15 SUMMARY OF THE INVENTION 

The present invention is directed to methods for using one or more faulty 
computations made by a cryptography device to infer secret information stored 
in the cryptography device. The inventive method is based on the well- 
accepted proposition that no computing system is perfectly fault free. In a 
20 preferred method, a security expert or cryptosystem designer may intentionally 
induce a tamper proof device or other cryptography device to generate a faulty 
computation by subjecting the device, such as a smart card, to physical stress. 
Such physical stress may be, for example, certain types of radiation, atypical 
voltage levels, or a higher clock rate than the device was designed to operate 
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at or accommodate. Cryptosystems and/or cryptography devices should 
preferably be impervious to the attacks described herein. If not, the system or 
device should desirably be modified. In some cases it may be desirable to 
discard the system. 

5 In certain cryptosystems, such as a signature scheme based on the well 

known Chinese Remainder Theorem, a single error of any type is sufficient to 
crack the system. In certain other cryptosystems, such as certain 
authentication schemes, repeated errors of a specific type are used to crack the 
system. The inventive methods are useful tools for security experts and 
10 cryptography experts when testing or developing a cryptosystem or 
cryptography device. Thus, the inventive method may be used to provide 
cryptosystems and/or cryptography devices impervious to cracking due to 
transient hardware faults. 

In a first embodiment of the present invention, the RSA Chinese 
15 Remainder Theorem based signature scheme and Rabin's Signature scheme 
(both of which may separate into linear components) are cracked by comparing 
a single erroneous signature on a message with a correct signature on the same 
message. In a second embodiment, these two schemes may be cracked with 
only a single erroneous signature if the content of the signed message is 
20 known. 

In a third embodiment, a certain type of fault called a register fault is 
used to crack the Fiat-Shamir and Schnorr authentication schemes. This is 
done by receiving a correct and a faulty value during an authentication process 
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to determine a secret value. Using this secret value, sets of data may be 
constructed which will reveal the other party's secret key. 

In a fourth embodiment, erroneous signatures of randomly selected 
messages are each used to obtain a portion of a secret exponent. When a 

5 sufficient number of bits are obtained, the remaining bits may be "guessed" to 
obtain the entire secret exponent. 

The inventive method is a creative use of a cryptography device's 
miscalculations. Because it is believed that all computers are prone to error, 
even cryptosystem servers stored in a secure environment may not be secure 

10 from these attacks. Thus, even such servers should be tested using the 
inventive method cracking cryptosystems. These attacks reveal an important 
finding: cryptography devices -- from smart cards to network servers used by 
certification authorities which oversee the distribution of public key certificates - 
- should now not only conceal their inner circuitry (to avoid revealing its secret 

15 key), but must also be fault resistant, to avoid generating erroneous 
calculations. The present invention provides a method for designing and 
implementing cryptosystems and cryptography devices impervious to cracking 
due to transient hardware faults. 

20 BRIEF DESCRIPTION OF THE DRAWINGS 

The present invention is described with reference to the following figures: 
Fig. 1A is a block diagram of a typical cryptography device; 
Fig. 1 B illustrates a communications network over which cryptography devices 
may communicate; 



Fig. 2 is a block diagram of a typical tamper proof device, such as a smart card. 

Fig. 3 illustrates a first method according to the present invention; 

Fig. 4 illustrates a second method according to the present invention; 

Fig. 5 illustrates a third method according to the present invention; 

Figs. 6A and 6B are flow charts illustrating two conventional exponentiation 

functions; and 

Fig. 7 is a flow chart of an inventive method used with the methods of Figs. 6A 
and 6B. * 

DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS 

The present invention is described in the following sections: 

I. Types of Faults which may occur which permit certain cryptosystems to 
be cracked are described with reference to Fig. 2. 

II. Cracking Cryptographic Signature Implementations that Use the Chinese 
Remainder Theorem is described with reference to Figs. 3 and 4, 
including discussion of the RSA Signature Scheme and the Chinese 
Remainder Theorem, Cracking the RSA Signature Scheme, and Cracking 
the Rabin Signature Scheme. 

III. Using Register Faults To Break Cryptosystems is described with 
reference to Figs. 5, 6A, 6B, and 7, including discussion of Using 
Register Faults to Attack the Fiat-Shamir Authentication Scheme, Using 
Register Faults to Crack Schnorr's Authentication Scheme, and Using 
Register Faults to Crack Other RSA Implementations. 
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IV. 
V. 



Providing Cryptosystems and Cryptography Devices which Resist 
Tampering Due to Hardware Faults is described. 
A Conclusion is provided. 



5 I. Types of Faults 

a. Overview of Faults 

Several types of faults may enable a cryptosystem to be cracked. These 
faults include transient hardware faults, latent faults, and induced faults. 

Cryptography devices, such as the device illustrated in Fig. 1 A, described 

10 above, are subject to random transient hardware faults. Random transient 
hardware faults may cause an erroneous output from the cryptography device. 
Referring to Fig. 1 A, a random transient hardware fault in the processor 1 02 or 
memory 104, 106 may cause the certification authority to generate on rare 
occasion a faulty certificate. If a faulty certificate is sent to a client, that client 

15 may be able to break a certification authority's system and generate fake 
certificates. 

A latent fault is a hardware or software bug which may be difficult to 
detect. Such bugs may occur in the design of the processor 102, or in the 
design of software stored in the main memory 104 or the disk memory 106. 
20 On rare occasions such bugs may cause a certification authority or other 
cryptography device to generate a faulty output. 

Induced faults may occur when a security expert or cryptosystem 
designer has physical access to a cryptography device. The security expert or 
cryptosystem designer may purposely induce hardware faults by, for example, 



attacking a tamper proof device by deliberately causing it to malfunction. An 
induced fault may, for example, briefly alter a value stored in the main memory 
1 04 or the disk memory 1 06. Erroneous values computed by the device allow 
the security expert or cryptosystem designer to extract secret information 
5 stored in the cryptography device. 

The present invention generally assumes that any faults generated by the 
cryptography device are transient. That is, the faults only affect current data, 
but not subsequent data. A transient fault may be a bit stored in a register 
which spontaneously flips or a gate which spontaneously produces an incorrect 
10 value. In such instances, the hardware system is typically unaware that any 
change has taken place. The present invention also assumes that the 
probability of such faults is so small that only a small number of them ever 
occur during a single computation, 
b. Register Faults 
15 A certain type of fault -- a register fault - is used to crack certain public 

key authentication cryptosystems, as described below. A register fault is a 
transient corruption of data stored in one or more registers. Because one or a 
few bits in a register are corrupted, the erroneous calculation will have certain 
predictable properties (such as being a power of 2 or a sum of a few powers 
20 of 2). 

As seen in Fig: 2, a tamper proof device 200, such as a smart card, 
comprises circuity such as a processor 202 and a small amount of memory 
204. The circuity 202 performs certain arithmetic operations and the memory 
(typically several registers 206 and a small RAM 208) stores temporary values. 
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An I/O 210 is provided to receive and transmit data. An electrically erasable 
programmable read only memory (EEPROM) 212 may be provided for storing 
secret information, such as secret keys. These components 202 - 210 are 
connected by a bus 220. 

5 With low probability, one or a few of the bits of the value stored in some 

register 206 may invert (e.g., change from a logic 0 to a logic 1 or vice-versa). 
It is assumed that this event occurs with sufficiently low probability so that 
there is some likelihood of a fault occurring only once throughout a 
computation. These errors may be transient and the hardware may not be 

10 aware that the data corruption has occurred. 

Under normal operating conditions, hardware is substantially error free. 
However, when such hardware is placed under physical stress, such as being 
placed in an extreme environment such as exposing it to certain radiation, 
atypical voltage levels, or fast clock signals, errors are likely to occur. This 

15 extreme environment may not affect the circuity, but may cause certain register 
cells to spontaneously, temporarily invert. Such faults are referred to herein as 
"register faults". A security expert or cryptosystem designer may intentionally 
subject a tamper proof device 200, such as a smart card (or other cryptography 
device), to an extreme environment in order to test whether the device may be 

20 induced to generate an erroneous output. If so, the system may be cracked. 
Also, it is a well-accepted that no computing system is entirely error-free. 
Thus, even in the absence of physical stress any cryptography device is 
susceptible to generating an erroneous output on rare occasions. 

25 
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II. Cracking Cryptographic Signature Implementations 
That Use the Chinese Remainder Theorem 

5 One version of the present invention relies on the Chinese Remainder 

Theorem (CRT) to crack the RSA/CRT and Rabin modular square schemes. The 
Chinese Remainder Theorem is well known and described, for example, in A. 
Aho, J. Hopcroft, and J. Uilman, The Design and Analysis of Computer 
Algorithms , pp. 294-303 (Addison-Wesley 1974). The content of this 

10 reference is incorporated herein by reference.- 

a. The RSA Signature Scheme And The Chinese Remainder Theorem 
The RSA signature scheme may be implemented in a tamper proof device 
200, such as a smart card, and may be used to perform various encryption and 
decryption functions for its owner, party /'. The tamper proof device typically 

15 contains in the registers 206 a secret RSA decryption key which is used to 
decrypt messages for party /. This device 200 may be used, for example, to 
prepare digital signatures for party /, to authenticate party / to another party /, 
and to decrypt incoming encrypted messages. Assume that some secret 
information (such as party /'s secret key) is stored in a tamper proof device. 

20 Because the device 200 is tamper proof, it cannot be opened and its contents 
examined. Thus, it is assumed that the secret information stored in the device 
cannot be extracted by opening the device. 

For illustrative purposes, the present version of the invention will be 
described as a device for obtaining digital signatures for party /. Let N=pq be 

25 a product of two large prime numbers. To sign a message m using the RSA 
signature scheme, the tamper proof device 200 uses the processor 202 to 
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compute E=m si (mod N) where s, is a secret exponent stored in the register 
206. The message m is assumed to be an integer in the range from 1 to N. As 
described above, the security of this system relies on the fact that factoring the 
modulus N is difficult. If the factors p,q of N are known, one can easily crack 
5 the system and sign documents without prior knowledge of the secret exponent 

S;. 

The computationaly expensive part of signing using the RSA scheme is 
the modular exponentiation of the input m, which is performed by the processor 
202. For efficiency, many implementations of the RSA scheme exponentiate 
10 signature £ into two portions £, and E 2 as follows: first £, = X s (mod p) and E 2 
= X s (mod q) are computed. Second, the Chinese Remainder Theorem is used 
to compute the RSA scheme signature £ = rrf' (mod N). 

Let a, b be two integers pre-computed by the processor 202 and stored 
in memory 206, which integers satisfy: 

a=l (mod p) b=0 (mod p) 

and 

a=0 (mod q) b=l (mod q) 

15 (2) 
Such integers always exists and can easily be determined by the processor 202 
given p and q. It now follows that: 

E=aE 1 +bE 2 (mod N) 

(3) 

The signature £is computed by processor 202 by forming a linear combination 
20 of £ 2 . This exponentiation algorithm is more efficient than using the 
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processor 202 repeatedly to square modulo N because the numbers involved 

are smaller. 

b. Cracking the RSA Signature Scheme 

1 . Cracking the RSA Signature Scheme By 

Comparing a Correct and an Incorrect Signature 

Using the linear combination set out above, the modulus N may be 

determined by a cryptography device such as the device 100 seen in Fig. 1 A 

or a computer or other processor by comparing a correct signature £ with an 

incorrect signature £for the same message. The inventive method is illustrated 

in Fig. 3. Let m be a plain text message and let £ = m s/ (mod N) be the correct 

cryptographic signature of the message received by cryptographic device 100 

at the I/O 108 and stored in memory 104 or 106. Let £ be a faulty 

cryptographic signature for the same message m, and which is also received by 

the device 100 and stored in memory 104 or 106. 

As seen in Fig. 3, party /"s cryptography device 200 generates signature 

£ for message m. £ is transmitted to party y's cryptography device (or other 

processor) 100. Party y's cryptography device stores £ in memory (step 1). 

Party j may be a security expert or cryptosystem designer. For clarity of 

illustration, the inventive method is described as a first cryptography device 

generating faulty computations and a second cryptography device or processor 

"cracking" the cryptosystem. It is also contemplated, however, that the 

inventive method may be performed by a single cryptography device. Party i's 

cryptography device generates an erroneous signature £ for the same message 

m. This erroneous signature may be generated, for example, while a tamper 

proof device 200 is placed under physical stress, such as being placed in an 
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extreme environment, which is likely to cause hardware faults. £is transmitted 
to party j's cryptography device or processor. Party j's cryptography device 
100 stores £ in memory (step 2). 

Recall that £ and £ are computed as: E = a£, + bE 2 (mod N) and £ = 
5 aE, + bE 2 (mod N), respectively. Because hardware faults occur with low 
probability, it is reasonable to assume that a hardware fault occurs during the 
computation of only one of E„ E 2 . Thus, it is assumed that a hardware fault 
occurs during the computation of £,, but no fault occurs during the computation 
of £ 2 . Thus, £ 2 = E 2 . 
10 Party j's cryptography device now uses £ and £ to obtain N in the 

following manner. Observe that: 

£ - £ = fa£, + bE 2 ) - (aEj + bE 2 ) 

(4) 

Because E 2 = E 2 , this equation becomes: 
15 aE, + bE 2 - a£i - bE 2 = a£, - a£, = a (E.-E,) 

If £,-£/ is not devisable by p, then: 

gcd (E-EM = gcd (a (E r E„N)) = Q 

(5) 

20 (step 3). Once q is obtained, party J's cryptography device or processor 100 
may easily determine N (step 4). 

If the factors of N are randomly chosen by the tamper proof device 200, 
then it is extremely unlikely that p divides £,-£,. This is unlikely because £,-£, 
can have at most log /V factors. This limited number of factors is because the 
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lengths of £ and £ limit the number of times these numbers may be divided by 

a smaller quantity. 

By using one faulty and one correct value of the same RSA signature, the 

modulus used in the RSA system can be easily determined. In this attack, it 

5 makes no difference what type of fault occurs or how many faults occur in the 

computation of £,. Moreover, to determine the modulus N, only one correct 

and one incorrect signature of the same message needs to be received. All that 

is assumed is that the fault occurs in the computation modulo of one of the 

primes p, q only. 

10 2. Cracking the RSA Signature Scheme 

Using Only An Incorrect Signature 

In fact, one faulty signature of a known message m is sufficient to obtain 

N. This version of the inventive method is illustrated in Fig. 4. No correct 

15 signature of the same message is required. Let £ = rrf 1 mod N. Let £ be a 

faulty signature having the same fault as above, that is £ = £ mod q but £ m 

£ mod p. Party i's cryptography device 200 generates £ and transmits £ to 

party y's cryptography device or processor 100. Party y's cryptography device 

or processor receives £. {step 1). It now follows that: 

gcd (M-£ ei , N) = g 
20 (6) 
where e,- is the public exponent (or public key) used to verify the decrypted 
signature, i.e., E** = m mod N {step 2). Once q is determined, party y's 
cryptography device 1 00 or processor may easily factor N {step 3). Thus, if the 
cryptography device 100 or processor knows message m, it may factor the 



modulus given only one faulty signature. This is important because some RSA 
signature implementations avoid signing the same message twice by using a 
"padding" technique. 

If the padding is not random (i.e., the padding is an n-bit number 

5 appended to the end of the message), the message m may be determined. This 
improvement shows that as long as the entire signed message is known, even 
non-random padding protected RSA/CRT systems are vulnerable to the 
hardware faults attack with only a single faulty signature. If the padding is 
random, then the message m cannot be separated from the padding and the 

10 message m is not known. This method will not work if the message is not 
known. 

c. Cracking the Rabin Signature Scheme 

The expensive part of signing using Rabin's signature scheme is the 
15 extraction of the modular square root. This, as with the RSA signature scheme, 
is usually implemented using the Chinese Remainder Theorem. A cryptography 
device such as a smart card 200, may use its processor 202 to compute: 

E =Jd' (mod, N) 



(7) 



20 



The processor 202 first computes: 

E x =yfD (mod. p) and E 2 =/D (mod q) 



(8) 
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This is done using a standard square root algorithm modulo a prime. The 
processor 202 may use the Chinese Remainder Theorem to compute signature 
E. Using the same a, b, defined above, E is determined as: 

E=aE 1 +bE 2 (mod N) 

(9) 

5 Because the Rabin Signature Scheme may be divided into a linear 

equation similar to the RSA signature scheme (see eq. 4), the same attacks 
described above with reference to Figs. 3 and 4 may be used to crack the 
device using the Rabin signature scheme. Under the first attack (Fig. 3), the 
device signs the same message twice, one signature, E, is obtained in normal 

10 conditions and is therefore the correct one. The second signature, E, is 
erroneous. The erroneous signature E may be obtained, for example, in an 
extreme physical environment and therefore is likely to be the erroneous 
signature. As described above, gcd {E-E, N) is likely to yield a factorization of 
N. Under the second attack (Fig. 4), if the cryptography device 100 or other 

15 processor knows document D it may factor the modulus without comparing it 
to a correct signature of the same message. 

III. Using Register Faults To Crack Crvptosystems 

20 a. Using Register Faults to Attack 

the Fiat-Shamir Authentication Scheme 

The Fiat-Shamir authentication scheme may be cracked by correctly 

guessing the value of the error caused by a register fault. Because register 

25 faults have known properties (they are powers of 2 or a product of powers of 
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2), the error may be easily guessed by a processor. Using the Fiat-Shamir 
authentication scheme, a security expert's or cryptosystem designer's 
cryptography device 100, computer, or other processor may compare an 
erroneous message with a correct message to obtain a random number r 
5 selected by party i's cryptography device, such as a tamper proof device 200 
of Fig. 2. Once r is known, the security expert's or cryptosystem designer's 
cryptography device 100 or other processor may perform calculations to 
determine party i's secret key. 

Party i's secret key, comprising a number of bits s„...,s f , may be 

10 recovered by party y's cryptography device by using register faults. Given t 
faulty runs of the protocol, party y's cryptography device may recover the secret 
key bits s ? ,...,s f with probability of 1/2 using 0 (n 2 t) arithmetic operations, 
where 0 is order of magnitude. 

This inventive method is illustrated in Fig. 5. Assume party / uses a 

15 tamper proof device 200 on which the secret key bits are embedded in register 
206 and from which the secret key bits cannot be extracted. Party y is a 
security expert or cryptosystem designer trying to discover the secret key bits 
stored in party i's tamper proof device. To do so, party y's cryptography device 
executes the protocol below several times. The protocol is performed as 

20 follows. Party i's device generates i 2 mod N and transmits this value to party 
j's device. Party j's cryptography device observes the value t 2 mod N generated 
by party i's device (step 1 ). Party y's cryptography device then selects a subset 
S£ {1,...f} (step 2) and observes the value y=/fl ,- GS s, returned to the device. 
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Assume that due to a register fault in party /"s tamper proof device, one 
bit of a register holding a value r is inverted while party /"s device is waiting for 
party /' to send to it subset S. In this case, party j has already received the 
correct r 2 mod N value during step 1 of the protocol. However, the y value 
5 computed by party / in step 3 is incorrect. Due to the register fault, party i's 
device outputs: 

y=(r^)n ies si 

(10) 

where E is the value added to the register as a result of the register fault (step 
10 3). This value is transmitted to party j's device. Recall that party J's 
cryptography device knows the value of n /cs v, from step 4 of the Fiat-Shamir 
protocol. Thus, party J's cryptography device may compute: 

(r+£) 2 = (mod N) 

(11) 

wherein v, = s, 2 

15 

Because E is an inverted bit in a register, it is a binary number of low weight, 
i.e., a power of 2 or a sum of few powers of 2 (i.e., E=2 k for some 1 < k < 
n). Thus, party J's cryptography device can easily determine the value of £by 
selecting all possible values of E until the correct value is determined (step 4). 
20 If E is correctly guessed, then party J's cryptography device may recover r 
because: 
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(r+£) 2 -r 2 =2£r+£ 2 (mod N) 

(12) 

(step 5). This linear equation for r can be easily solved. Party /"s ability to 
discover the secret random r is the main observation which permits the system 
to be cracked. 

Using the values of r and E, party f's cryptography device may compute: 

lies J r v 

(13) 

Thus, party j may compute the value n,- eS s,- by guessing the fault value £ and 
using the formula: 

FT Si = — (mod N) 

Ilies V ± 



(14) 

(step 6). 

Party j may now verify that fault value E was correctly guessed. Let T 
be the guessed value of n /<rS s, obtained from equation ( 1 4) above. To verify that 
E is correct, party J's cryptography device checks that 7 2 = n /eS Vj. There is a 
high probability that only one low-weight value £ exists where this relationship 
is satisfied. Therefore, if the relationship is satisfied, party / is very likely to 
have obtained the correct value of n /eS s,. 
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In the unlikely event of two values E, E' satisfying the relation, party /' 
may still crack the cryptosystem. Observe that the relation iy') 2 = (r') 2 T 2 
implies that T 2 = n /eS s,. 

If there exists two low weight values E, £' generating two values T, T, wherein 
5 T * T satisfying the relationship, then T 2 = T 2 (mod N). If T * T (mod N\ 
then party j's cryptography device already may factor N. 

Assume T = -T (mod N). Because one of Tor T equals n /eS s, (i.e., one 
. of E, E' is the correct fault value), it follows that party / now knows that n /eS s ; 
up to the sign. This is sufficient to crack the cryptosystem. Because E is a low 
10 weight binary value, party j's cryptography device may substitute all possible 
values for E until the correct value is determined. 

Once party j has a method for determining n, eS s, for various sets of S of 
party j's cryptography device's choosing, party /may easily find party i's secret 
key bits s v ...,s t . A simple approach is for party y's cryptography device to 
15 construct n, vs s, for singleton sets, i.e., sets S containing a single element. If S 
= {k}, then l~l /eS S; = s k and therefore s* may be found for each k. If party i's 
tamper proof device 200 refuses to accept a singleton set, party /may still find 
party i's secret keys in the following manner. Party j's cryptography device 
may select sets at random such that resulting characteristic vectors are linearly 
20 independent. A set is represented as follows: 5 £{i ,...,f) by its characteristic 
vector U G (0,1)'. That is, U, = 1 if iGS and U, = 0 otherwise. Party/ picks 
sets S u ...,S t such that a corresponding set of characteristic vectors U u ...,U t 
form afxf full rank matrix over Z 2 , where Z 2 is a ring of integers, modulo 2 
(step 7). Party j's cryptography device then performs the Fiat-Shamir 
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authentication scheme above to construct the values T,= n /fS s, for each of the 
sets S u ...,S t (step 8). 

For example, party /may determine s,, by constructing elements a y ,...,a t 
e {0, 1} such that: 

a 2 U 2 +. . . + a t U t = (1,0,0, ...,0) (mod 2) 

(15) 

These elements may be efficiently constructed because the vectors U t are 

linearly independent over Z 2 . When all the computations are completed over the 
integers, the following is obtained: 

a 1 U 1 + ... + a t U t = (2b 1 + l, 2b 2 , 2b 3 , . . . , 2b t ) 

(16) 

for some known integers b,,...,b v Party /s cryptography device may now 
compute s, using the formula: 

s 2 = Tl ' ' ' Tt (mod N) 
v* 1 . . . L 

(17) 

(step 9). Recall that the values v, = s ; 2 (mod N) are publicly available. The 
values s 2 ,...,s k may be obtained using the same procedure. 

The procedure above made use of t faults and took 0 (n 2 t) arithmetic 
operations. The faults occur while party i's device is waiting for a challenge 
from the outside world. Consequently, the security expert knows when the 
register faults are induced. 

26 



The Fiat-Shamir scheme may be modified. Recall that in the Fiat-Shamir 
protocol set out above, in step 2, party / sends r 2 (mod N) to party/; and in step 
4, party /verifies party /'s identity by checking that y 2 =r* n /eS v, (mod N). If 
this protocol is modified to use higher powers instead of just squaring the 
values, the inventive method illustrated in Fig. 5 may still be used to crack the 
modified scheme. 

Assume that the modified scheme uses a publicly known exponent e 
instead of squaring. As before, party i's secret key is a set of invertible 
elements (bits) s v ...,s t (mod N). Party i's public key is a set of bits v, = 
s,*,...,^ = s f e (mod/V). Party /authenticates itself to party /using the following 
protocol: 

1 . Party i's cryptography device, computer, or other processor 
selects a random r, generates a* mod N and transmits this value to 
party / via an I/O. 

2. Party j's cryptography device or other processor selects a random 
subset SS (1 ,...,f), and sends the subset to party i's device via an 
I/O. 

3. Party i's cryptography device computes /"n,- es s,. 

4. Party j's cryptography device verifies party i's identity by checking 
that y* = f n to v 7 (mod N). 

When e = 2, this protocol is the same as the original Fiat-Shamir protocol 
described above. Using the methods described above, party j may obtain the 
value L, =f (mod N) and L 2 = {r+E) e mod N. As above, assume that party j's 
cryptography device has correctly guessed the value of E. Given these two 
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values, party J's device may recover r by observing that r is a common root of 

the two polynomials: x" = l 1 (mod N) and (x + E) e = L 2 (mod A/). 

Furthermore, r is likely to be the only common root of the two polynomials. 

Consequently, when the exponent e is small, e.g., e<n 2 , party /' may recover 
5 r by computing the greatest common divisor of the two polynomials. Once 

party/' has a method for computing rhe can recover the secret key bits s 1f ...,s t 

as discussed above. 

b. Using Register Faults to Crack Schnorr's Authentication Schgme 
Using register faults, secret integer s, of the Schnorr authentication 
10 scheme may be extracted from party i's cryptography device. When p is an n- 

bit prime number, the attack requires n log n faulted values and O Kn 2 ) 

arithmetic operations. This is done as follows: 

Let p be an n-bit prime number. Given n log n faulty runs of the protocol, 

secret key s, may be recovered with probability at least Vi using 0(n 3 ) arithmetic 
15 operations. 

Party / wishes to extract the secret information stored in the device. 
Party /'s cryptography device or other processor selects a random challenge f. 
The same challenge will be used in all invocations of the protocol. Because 
party i's device cannot possibly store all challenges given to it thus far, it 
20 cannot possibly know that party / is always providing the same challenge f. 
The attack will enable party /to determine the value f-s, mod p from which the 
secret value s, can be easily found. For simplicity, set x — fs, mod p and assume 
that gr* mod p is known to party y's device. 
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Suppose that due to a register fault in party i's device, one of the bits of 
the register 206 holding the value r is flipped while the device is waiting for 
party y's device to send it the challenge f. More precisely, when the third phase 
of the protocol is executed, the party i's device finds t = r+2' in the register 
5 holding r. Consequently, party i's device will output 0 = t + x mod p. Party /"s 
device may then determine the value of / (the fault position) by trying all 
possible values i=Q,...,n until finding an /'satisfying: 

g a ='g 2i g r g x (mod p) 

(18) 

10 Assuming a single bit flip, there is exactly one such /'. The above identity 

proves to party /that t=r+2' showing that the rth bit of r is 1 . 

This information permits party y to recover x in time 0(n 2 ). Assuming 

that the register faults occur at uniformly and independently chosen locations 

in the register r, s } may be recovered in time O (n 2 ). It follows that with 
15 probability at least % that a fault will occur in every bit position of the register 

r. In other words, for every 1 < / < n there exists an such that the 

/th bit of is known to party J (the first bit is the LSB). 

To recover s,, party f's cryptography device first guesses the log 8n bit 

strings until the correct one is found. Let X be the integer that matches x on 
20 the most significant log 8a? bits and is zero on all other bits. Party y's device 

correctly guesses the value of X. Party y's device may recover the rest of s, 
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starting with the LSB. Inductively, suppose party j's device has already 
determined bits s^,...^^, of x. (Initially / = 1). Let: 

(19) 

To determine bit s„, party J's device uses r*' 1 of which it knows the rth bit and 
the value of x + r 1 ' 1 . Let b be the /th bit of r®. Then 

x ± =b e i'th bit(x+r (i) -Y-X mod p-i) 

(20) 

assuming no wrap around, i.e., 0_< x + r t ' l -V-X<p-1 (the remainder cannot be 
greater than the number being divided). Because x-X<p/8n, wrap around may 
occur only if >(1-1/8n)p. Since the rs are independently and uniformly 
chosen in the range \0,p), the probability that this does not happen in all n 
iterations of the method is more than %. 

Once X is correctly determined, the method runs in linear time and 
outputs x with probability at least Vz. (The reason for the Vz is that all bits of 
r should be "covered" by faults and all r } should not be too large. Both events 
are satisfied with probability at least %.) Of course, once a candidate x is 
found, it can be easily verified using the public data. There are 0{n) possible 
values for X and thus, the running time of this step is 0(n 2 ) . 

This attack also works in the case of multiple bit flips of the register r. 
As long as the number of bit flips is constant, their exact location can be found 
and used by party /. Note that the faults occur while party /'s device is waiting 
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for a challenge from the outside world. Consequently, party / knows exactly 

at what time the faults should be induced. 

c. Using Register Faults to Crack RSA Implementations 
Register faults may be used to break other RSA implementations that are 
5 not based on the Chinese Remainder Theorem. Let N be an /7-bit RSA 

composite and s, be a secret exponent. The exponentiation function x -> x* 

mod N may be computed using either of the following conventional methods 

600, 650 illustrated in Figs. 6A and 6B: 

• Method I (Fig. 6A) 

10 init y «- x; z *- 1 (step 602). 

main For k = (steps 604, 610). 

if kth bit of s is 1 (step 606) then z *- zy (mod N) (step 

608). 

y*- y 2 (mod A/) (step 610). 
15 Output z (step 612). 

• Method II (Fig. 6B) 
init z «- x (step 652). 

main For k = /7-1 down to 1 (steps 654, 662). 

if /rth bit of s is 1 (step 656) then z *- z 2 x (mod N) (step 

20 658) 



otherwise, z *- z 2 (mod N) (step 660). 
Output z (step 664). 
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For both methods 600, 650, given several faulty values by a 
cryptography device, a security expert's or cryptosystem designer's 
cryptography device, computer, or processor may obtain the secret exponent 
in polynomial time. In this version of the invention, faulty values are obtained 
5 in the presence of register faults. This attack uses erroneous signatures of 
randomly chosen messages; the attacker need not obtain the correct signature 
of any of the messages. Furthermore, an attacker's cryptography device or 
processor need not obtain multiple signatures of the same message. 

With probability of at least 1 12, the secret exponent s,- can be extracted 
10 from a device (such as smart card 200) implementing the first exponentiation 
algorithm by collecting (n/m) log n faults and 0 (2 m -/7 3 ) RSA encryptions, for any 
1 <_ m < n. For a small public exponent e, this takes O (2 m -/? 4 ) time. For a 
random e, it takes O (2 m -n 5 ) time. 

The following faults are used: let m be a message to be signed and m 
15 e Z N , where Z N is a ring of integers modulo N. Suppose that a register fault 
occurs at a single random point during the computation of m* mod N. That is, 
at a random point in the computation one of the bits stored in a register (such 
as register 206) flips. The resulting erroneous signature is E. An ensemble of 
such erroneous signatures enables one to recover the secret exponent s,-. Even 
20 if other types of faulty signatures are added to the ensemble, they do not 
confuse the inventive method. 

Let / = {n/m) log n and let m u ...,m L e Z N be a set of random messages. 
Set £j = mf mod N to be the correct signature of a message m,. Let £, be an 
erroneous signature of the message m,. A register fault occurs at exactly one 
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point during the computation of £ r Let k- t be the value of k (recall k in the 
counter in Method I, 600 above) at the point at which the fault occurs. Thus, 
for each faulty signature there is a corresponding k, indicating the time at 
which the fault occurs. The messages may be sorted by a processor (i.e., 202 
5 of Fig. 2) so the 1 <_ k x <_ k 2 <....<_ k, < n. The time at which the faults occur 
is chosen uniformly (among the n iterations) and independently at random. It 
follows that given / such faults, with the probability at least half - k, < for 
all / = 1 ,...,/?. Since the location of the faults are unknown, the values k t are 
also unknown. 

10 Let s, = s„, s,,.,,...^ be the bits of the secret exponent s, where s„ is the 

MSB and is the LSB. Each of the bits in s, is recovered one-by-one. A block 
of these bits at a time may be recovered starting with the MSBs. Assume bits 
s n , s n . 1f s*, for some / are known. Initially /' = / + 1 indicating that no bits 
are known and it is desired to determine the next bit. Bits s ki . u s ki _ z ,...s k! _, may 

15 be recovered in the following manner. All possible bit vectors are tried by a 
cryptography device or computer until the correct one is found. Note that the 
location within s, of each bit s„, s„. 1# ... is unknown. Because even the length 
of the block is unknown, all possible lengths are tried. The inventive method 
for determining the next bit may be performed by a cryptography device or 

20 computer processor using the method 700 illustrated in Fig. 7 and set out 
below. 

1. Initialize r = 0 (step 702); 

2. For all lengths r = 0, 1, 2, 3,. ..(step 704) do: 

3. For all candidate /--bit vectors U ki -s, U ki - 2 ...U ki . r (step 706) do: 
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4. Set: 

(21) 

In other words, w matches the bits of s and U at all known bit positions 
and is zero everywhere else (step 708). 
5 5. Test if the current candidate bit vector is correct by checking if 

one of the erroneous signatures E jf / = 1 ,...,/ satisfies (step 710): 

3ee{0, ... ,n} s.t. (E^±2 e /nJ) ei =^ (mod N) 

(22) 

wherein e is the public exponent. (The ± means that the condition is satisfied 
if it holds with either a plus or a minus.) This step means that all combinations 
10 of bits using this erroneous bit are tested until the proper location is found. The 
inverse of the erroneous bit is the correct bit in that location. 

6. If a signature satisfying the above condition is found (step 712), 
the cryptography device outputs u k ^ u k/ . 2 ...u kM and stops (step 
714) for that r. At this point it is determined that /r A , =£/-/- and s w1 
15 Ski-2>-~' s ki-i = u ki-i u k,-2'--' u ki-r ,f a signature satisfying the condition 

is not found, another candidate vector is tried (step 716). 
Steps 706-716 are repeated for each r between 0 and n (steps 718, 
704). The condition at step 710 is satisfied by the correct candidate u ki _ u u ki . 
2 ,...,£/ JtM . Recall that E iA is obtained from a fault at the Ar M st iteration. At the 
20 fc M st iteration, the value of z was changed to z *- z ± 2 e for some public 
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exponent e. Notice that at this point E iA =zM" iA . From that point on no fault 
occurred and therefore the signature £ M satisfies: 

E i _ 1 = zMw i _ 1 =S i _ 1 ±2 e Mw i _ 1 (mod N) 

(23) 

When in step 710 the signature £ M is correct, it properly verifies when raised 
to the public exponent e. Consequently, when the correct candidate is tested, 
the faulty signature guarantees that it is accepted. There is a high 
probability that a wrong candidate will not pass the test. 

Note that not all of the bits need to be determined in this manner. For 
example, if 450 bits of a 51 2 bit key are determined through register faults, the 
unknown 62 bits may be tested by trying different combinations of these 
unknown bits. Each combination is used as the secret key s, and a received 
message is attempted to be decrypted. If the message is properly decrypted, 
the combination used is correct. 

If the method obtains both the faulty and correct signature of each 
message m„ the running time is improved to 0(2 m n 2 ) arithmetic operations 
modulo N which takes time 6 (2 m A7 3 ). This follows since the error location E can 
be easily found using a lookup table of powers of 2 mod N. 

Using these algorithms, given n log n faulted values a cryptography 
device, computer, or other processor may recover the secret exponent in 
polynomial time. That is, for a message m £ Z N , given n log n faulted values 
output by a device computing the function m s/ mod N, the secret exponent s, 
may be recovered in polynomial time in n. A cryptography device or computer 
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may employ either one of the exponentiation methods above. Note that faulted 
values for this version of the present invention are register faults. 

The method illustrated in Fig. 7 may also be used to crack EIGamal's 
public key cryptosystem. In EIGamal's public key cryptosystem, party /' selects 
5 a secret exponent s, and publishes the public key y = g s ' mod p, where p is an 
/7-bit prime number. To send a message m to party /, party y"s device selects 
a random number b and sends to party / two values = m mod p and E 2 = 
g* mod p. Party / decrypts the message by computing £ 1 /f 2 s ' mod P- 
that is: 

jn _ g sb m (mod, p) 2 
g sb mod p mod p 

10 

(24) 

Assume party / uses a smart card 200 for decryption. The smart card 
contains in a register 206 the secret exponent s, and will output the plain text 
message. The attack on the RSA implementation discussed above permits the 
15 extraction of the secret exponent s ; from the smart card. 



IV. Providing Cryptosystems and Cryptography Devices 
Which Resist Tampering Due to Hardware Faults 

In addition to the attacks described above, it is believed that hardware 
fault based attacks may be performed on the following cryptosystems: 

1. DES; 

2. IDEA; 

36 



3. RC5; 

4. FEAL; and 

5. Skipjack. 

These are secret {or symmetric) key systems, not public key systems. 
5 Nevertheless, hardware based faults may permit these systems to be cracked. 

Regardless of whether a cryptosystem is a public or private key system, 
vulnerability to a fault-based attack results in a cryptosystem which has 
questionable security, regardless of whether the fault is generated by machine 
imperfection, software bugs, intentionally induced faults, or faults planted at 
10 the chip level during design and/or manufacturing. 

The Secure Electronic Transmission (SET) standard for on-line Internet 
bank card transactions address faulty computations. The standard provides 
that if a received message fails an authentication test, an error message is 
returned. Thus, erroneous security data is not expected, but acknowledged. 
15 This acknowledgement is available to eavesdroppers. Ideally, an assurance of 
zero faulty computation is the best protection. However, as discussed above, 
it is well-accepted that no computing system is entirely error-free. As a result, 
verifying cryptographic computations before outputting results is preferred. 
A simple way to avoid cracking due to hardware faults is to check the 
20 output of a computation before releasing it. This may require recomputing 
functions, which may sometimes result in an expensive or time consuming 
process which may be unacceptable. 

Authentication schemes may be attacked based on register faults in the 
internal memory of a cryptography device. Protection against such an attack 

37 



may include (1) detecting the fault; and (2) correcting the fault. Because a 
register fault changes the stored data, the device may have computed the 
(temporarily incorrect) data correctly. This recomputing the data may not reveal 
an error. In multi-round authentication schemes such as Fiat-Shamir, for 
example, error detection/correction bits, such as CRC bits, may be added to 
protect the validity of the stored data. 

Signature schemes may be attacked based on a fault during the 
computation of the signature. ,One way to overcome this attack is to verify the 
signature before outputting it. The device generating the signature may, for 
example, apply the signature verification algorithm on the signature before 
transmission. For example, this may be done in RSA signatures by applying the 
public key to the signature. A second way to overcome this attack is to pad 
the signed message with random bits. This may prevent an adversary from 
obtaining two copies of an identical message. 

An alternative approach to protecting RSA computations which do not 
use the Chinese Remainder Theorem is the use of blinding. To compute X s mod 
N, the cryptography device first picks a random number r and computes y = r e 
mod N, where e is the public exponent: The device computes (xyYIr mod N. 
The result is X s mod N. 

These attacks may be used in the design and testing of existing and 
future cryptosystems and cryptography devices. Although future cryptography 
devices may have the same overall structure as seen in Figs. 1 A and 2, such 
devices should preferably be modified to be impervious to hardware-fault based 
attacks. One way to design such a device may be to implement one of the 
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software solutions described above. Another way to design such a device is 
protect the device's internal storage from extreme environments by providing 
shielding or other hardware solutions. 

A cryptography device may be verified to be impervious to a hardware 
5 fault-based attack by subjecting the device to one or more of the attacks 
described above. The cryptography device may be verified to be secure against 
these attacks by verifying that an adversary cannot determine secret 
information stored in the cryptography device. 

10 V. Conclusion 

Methods for cracking public key cryptosystems are described wherein an 
erroneous calculation is used to infer secret information. The inventive method 
is a creative use of a cryptosystem device's miscalculations. Because it is 
believed that all computers are prone to error, even cryptosystem servers stored 

15 in a secure environment are not protected from the inventive method of testing 
public key cryptosystems. 

The inventive methods are particularly useful to security experts and 
cryptosystem designers. Existing and proposed cryptosystems are 
cryptography devices should be impervious to the attacks described. If not, the 

20 system or device should be modified or discarded. Smart cards, for example, 
should now not only conceal their inner circuitry (to avoid revealing its secret 
key), but also be fault resistant and/or check computed values before 
transmission, to avoid revealing secret information. 
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The above described embodiments of the invention are intended to be 
illustrative only. Numerous alternative embodiments may be devised by those 
skilled in the art without departing from the spirit and scope of the following 
claims. 
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CLAIMS 

We claim: 

./ 1 . A method for testing security of a cryptography device performing a 
cryptographic algorithm, comprising the steps of: 
5 a. generating a faulty computation in the cryptography device; 

b. receiving the faulty computation in a processor; and 

c. using the faulty computation, the processor determining heretofore 
> secret information stored in the cryptography device. 

10 2. The method of claim 1 , wherein the faulty computation is intentionally 
generated. 

3. The method of claim 2, wherein the faulty computation is intentionally 
generated by subjecting the cryptography device to a physical stress. 

15 

4. The method of claim 3, wherein the step of subjecting the cryptography 
device to physical stress further includes subjecting the cryptography device to 
at least one of radiation, an atypical voltage level, and a higher clock speed than 
the cryptography device was designed to accommodate. 

20 

5. The method of claim 1, further comprising the step of transmitting the 
faulty computation from the cryptography device to a second cryptography 
device housing the processor. 
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6. The method of claim 1 , wherein the cryptographic algorithm generates 
a digital signature which may be separated into linear components, wherein the 
step of determining heretofore secret information further comprises the 
processor comparing an erroneous signature having the generated fault on a 

5 digital message with a correct digital signature on the same digital message. 

7. The method of claim 1, wherein the faulty computation is generated by 
inverting at least one bit stored in a register of the cryptography device. 

10 8. The method of claim 7, wherein the step of determining heretofore secret 
information further comprises the processor comparing a correct value and an 
erroneous value containing the induced fault to determine the secret 
information. 

15 9. The method of claim 1 , wherein the cryptographic algorithm generates 
a digital signature, wherein the method further comprises the steps of: 

a. the step of generating a faulty computation further comprises 
inducing a faulty computation in a plurality of digital messages; 
and 

20 

b. the step of determining heretofore secret information further 
comprises: 

<i) the processor using a first fault to determine heretofore 
secret information; 
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(ii) the processor constructing sets of data for the 
cryptography device; 

(iii) the processor receiving from the cryptography device 
responses to the sets of data; and 

5 <iv) the processor using the heretofore secret information and 

the responses to determine a secret key. 

10. The method of claim 1, wherein the cryptographic algorithm is an 
authentication algorithm, wherein: 
10 a. the step of receiving the faulty computation comprises receiving 

the faulty computation in response to a challenge; and 
b. the step of determining heretofore secret information further 
comprises the processor using the faulty computation to determine 
a single bit of heretofore secret information; and 
15 c . repeating steps (a) and (b) above to determine a plurality of bits of 

secret information. 

/ 11. A method for testing the security of a cryptography device which 
performs a cryptographic algorithm which generates a digital signature which 
20 may be separated into linear components, the method comprising the steps of: 

a. storing in a memory a correct digital signature £ for a message m 
generated by the cryptography device; 

b. storing in the memory an incorrect digital signature £ for the 
message m generated by the cryptography device; and 
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c. using E and £, a processor determining heretofore secret 
information. 

1 2. The method of claim 1 1 , wherein method is performed by the processor, 
the method further comprising the steps of: 

a. the cryptography device sending E to the processor; and 

b. the step of determining heretofore secret information further 
comprises the first processor determining heretofore secret , 
information stored in the cryptography device. 

13. The method of claim 11, wherein the step of determining heretofore 
secret information further comprises the processor determining secret 
information q stored in the cryptography device using: 

gcd(£-£, N)=q 

wherein N is a product of prime numbers, and one of the prime numbers is q. 

1 4. A method for testing the security of a cryptography device performing 
cryptographic authentication algorithm, the method comprising the steps of: 

a. receiving from the cryptography device a value r 2 mod N, wherein 
r is a random number and N is a secret value which is a product 
of prime numbers; 
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b. generating a subset of integers S and providing the subset S to 
the cryptography device; 

c. receiving from the cryptography device y = (r+£)n, es s, in response 
to the subset S, wherein y is an erroneous value, s, is a secret 

5 exponent used to encrypt, and £ is a value added to r due to an 

error; 

d. a processor determining a value of E by computing: 

(r+E) 2 - (mod N) 



10 wherein v f = s, 2 

e. the processor determining a value of r by computing: 

(r+£) 2 -x 2 =2£r+£ 2 (mod N) 

and 

f. using the values of E and r, the processor determining s ( by 
15 computing: 



n. s± = (mod N) . 
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15. The method of claim 14, wherein the step of determining s, further 
includes the step of the cryptography device computing: 

TT e S i = 7^ (m ° d N) ■ 



5 16. The method of claim 1 4, further comprising the step of verifying whether 
the value of E is correct. 

17. The method of claim 16, wherein the step of verifying further includes 
the step of using the subset S to determine whether the value of E satisfies the 

10 relation (y') 2 = (r') 2 T 2 ; 

wherein T is a guessed value for n /es s, 

18. The method of claim 14, further comprising the steps of: 
a. the processor generating a plurality of subsets S; 

15 b. the processor receiving a value in response to each subset S; and 

c. using known values and the response value to each subset S, the 
processor determining heretofore secret information. 

1 9. The method of claim 1 8, wherein the step of generating the plurality of 
20 subsets S further comprises generating singleton sets. 
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20. A method for testing the security of a cryptography device performing 
a cryptographic authentication algorithm by determining secret information 
comprising a number of bits, the method comprising the steps of: 

a. a processor obtaining an erroneous digital signature E; 

b. the processor selecting a block length; 

c. the processor determining a candidate vector wthat matches all 
known bits of the secret information and is zero everywhere else; 

d. the processor determining if the candidate vector w is correct; 

e. if the candidate vector w is correct, the processor outputting a 
value for the selected block length; and 

f . if the candidate vector w is incorrect, the processor determining 
another candidate vector. 



21. The method of claim 20, wherein steps (c) - (f) are performed for a 
15 plurality of block lengths. 



22. The method of claim 20, wherein the step of determining the candidate 
vector w further comprises determining: 

20 wherein k, is a time at which an error may have occurred; s y is a bit which may 
be incorrect; r is a possible blocklength; and u is a bit which may be incorrect. 
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23. The method of claim 20, wherein the step of determining if the candidate 
vector w is correct further comprises determining: 

3ee{0, . . . ,n} s.t. (^±2 e mJ) ei =mj (mod N) 
wherein e = a public exponent; 

n = a number of bits in the secret information; 
rrij = is a message; 

e, = is a public signature verification exponent; and 
N = a product of prime numbers. 

24. A method for testing the security of a first cryptography device 
performing cryptographic authentication algorithm by using a second 
cryptography device to determine secret information comprising a number of 
bits stored in the first cryptography device, the method comprising the steps 
of: 

a. the second cryptography device sending to the first cryptography 
device a challenge f; 

b. the first cryptography device receiving t and generating a response 
u=r+ts mod p, wherein: 

r is a random number selected by the first cryptography device; 
s is the first cryptography device's secret key; and 
p is a large prime number; 

c. the second cryptography device receiving u; 

d. the first cryptography device receiving t again and generating a 
response ti = ?+x mod p, wherein: 
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t is an erroneous value of r and x is fs mod p; and 
e. the second cryptography device receiving 0 and determining a 
location of the error. 

25. The method of claim 24, wherein the step of determining the location of 
the error further comprises the steps of trying all possible locations of the error. 

26. The method of claim 25, wherein the step of trying all possibles locations 
further includes the step of determining which location for the error satisfies: 

g Q =g 2i g z g x (mod p) 

wherein: 

g is a generator of Z* p ; and 
/ is a location of the error. 

27. A cryptography device produced according to the steps of: 

a. generating a faulty computation in the cryptography device; 

b. receiving the faulty computation in a processor; and 

c. using the faulty computation, verifying that the processor cannot 
determine secret information stored in the cryptography device. 

28. The device of claim 27, further comprising providing the cryptography 
device before generating the faulty computation. 
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29. The device of claim 27, wherein the faulty computation is intentionally 
generated during testing of the cryptography device. 



30. The device of claim 29, wherein the faulty computation is intentionally 
5 generated during testing of the cryptography device by subjecting the 
cryptography device to a physical stress. 

3,1 . The device of claim 29, wherein the step of subjecting the cryptography 
device to physical stress further includes subjecting the cryptography device to 
10 at least one of radiation, an atypical voltage level, and a higher clock speed than 
the cryptography device was designed to operate on. 

32. The device of claim 27, wherein the cryptography device performs a 
cryptographic algorithm which generates a digital signature which may be 

15 separated into linear components, wherein the step of verifying that the 
processor cannot determine secret information further comprises the processor 
verifying that an erroneous digital signature having the generated fault on a 
digital message cannot be compared with a correct signature on the same 
digital message. 

20 

33. The device of claim 27, wherein the faulty computation is generated by 
inverting at least one bit stored in a register of the cryptography device. 
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34. The device of claim 33, wherein the step of verifying that the processor 
cannot determine heretofore secret information further comprises verifying that 
the processor cannot compare a correct value and an erroneous value 
containing the induced fault to determine the secret information. 

5 

35. A cryptography device that is impervious to a hardware fault-based 
attack, which attack comprises the steps of: 

a. generating a faulty computation in the cryptography device; 

b. receiving the faulty computation in a processor; and 

10 c. using the faulty computation, the processor determining secret 

information stored in the cryptography device. 



36. The device of claim 35, further comprising providing the cryptography 
device before generating the faulty computation. 

15 

37. The device of claim 35, wherein the faulty computation is intentionally 
generated during testing of the cryptography device. 

38. The device of claim 37, wherein the faulty computation is intentionally 
20 generated during testing of the cryptography device by subjecting the 

cryptography device to a physical stress. 
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39. The device of claim 38, wherein the step of subjecting the cryptography 
device to physical stress further includes subjecting the cryptographic device 
to at least one of radiation, an atypical voltage level, and a higher clock speed 
than the cryptography device was designed to operate on. 
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ABSTRACT 

A useful method of verifying the integrity of a cryptosystem involves 
using erroneous outputs to obtain secret information. In certain signature 
schemes which use the Chinese Remainder Theorem, a correct signature of a 
5 message and an erroneous signature of the same message permit the modulus 
to be easily obtained. If the content of the message is known, such 
cryptosystems may be cracked with only an erroneous signature of the 
message. Certain other authorization schemes may be cracked by analyzing a 
number of erroneous outputs caused by a particular type of error called a 

10 "register fault." A security expert or cryptosystem designer may intentionally 
induce a tamper proof device generate a faulty computation by subjecting the 
device, such as a smart card, to physical stress, such as certain types of 
radiation, atypical voltage levels, or a higher clock rate than the device was 
designed to accommodate. Cryptosystems should be impervious to the attacks 

15 described herein. If not, the system should be modified or discarded. 
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Fig. 3 



Party i ( 

Party i ' s cryptography 
device generates a 
correct signature E for 
message m and transmits E 
to party j's cryptography 
device . _ 



Party j 



\ Tarty j ' s cryptography : 
'. — I device receives E and 
stores it in memory. 



Party i's cryptography 
device generates ^ ^_ 
incorrect signature E for 
the same message m and 
transmits E to party j's 
cryptography device . _____ 



'Party j's cryptography 
v device receives E and 
stores it in memory. 



1 Party'"] ' s cryptography 
device determines 

gcd(E-E, N)=g. 



Having determined q, 
party j's cryptography 
device determines N. 



Fig. 4 



Party i Party j 



Party i's cryptography 
device generates 
erroneous signature E for 
known message m (i.e., 
message m is generated 
without padding or with 
non- random jpadding) and 
transmits E to party j's , 
cryptography device. j 

^party j's cryptography ' 
device receives E. •__ 

1 Party j ' s cryptography 
device determines 
gcd(M-S ei , N)=q. 

i Having determined q, 
; party j's cryptography 
device determines N. 
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Party i 



Party j 



. Party i ' s cryptography 
device selects a random 
r, generates r 2 mod N, 

; and transmits this value 
to party j ' s cryptography 
device . 



While waiting to receive 
S from party j's device, 
a value in party i ' s 
device is inverted. 
After receiving S from 
party j's device, party 
i's device generates 
y= (r+E) Ili^Si 
Party i ' s device 
transmits y to party j's , 
devi ce . _ _ : 



. Party j's cryptography 
' device observes the value 



r 2 mod N. 



Party j's cryptography 
device generates a 
random subset 
SB (1, . . . , t) and 
transmits S to party i's 
' cr yptography device . 



Party j' 

— * y- 



device receives 



"Party j '"sndfeyl'ce" 

determines E by finding 
an E satisfying 



(r+E) 2 



- (mod N) 



This is possible because 
E =2 k for some lukisn 



Party j ' s 

device may determine r- 
using : 
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2tz+£ 2 (mod N) 



Party j may use r to 
determine n i£S Si using: 
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-2*1 (moA/V) 



Party j ' s cryptography 
device determines 
n i£s s i ' f or various sets U d 
construced as either (1) 
singleton sets or (2) 
selected at random such 
that resulting 
characteristic vectors 
; are linearly independent . 
. ... •-- 4r 

Using the sets 
constructed above, party 
j's device performs the 
Fiat - Shamir 
authentication scheme, 
providing the sets to 
party i ' s dev ice . 



Using the response to the 
sets sent to party i ' s 
device, party j 
determines the secret 
values s x , . . . , s t . 
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